MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)PHICriticalContained

Welfare & Pension Administration Service

bd_3c90155397c03f17 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jul 21, 2021

Filed

Feb 18, 2022

To disclose

30 weeks

Affected

103,557state residents only

Linked

9 filings

Confidence

71%

Full breach record for Welfare & Pension Administration Service →2 incidents on file

WPAS, a third-party benefit plan administrator, disclosed a malware incident where its network was infected with ransomware encrypting systems. The breach impacted approximately 103,557 Washington residents, exposing PII, SSNs, financial data, and PHI. WPAS engaged forensic investigators, notified the FBI, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d30 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 6 days

discovery → filing · 30 weeks / 212 days

Jul 15, 2021

Begins

Jul 21, 2021

Discovered

Feb 18, 2022

Filed

vs. sector median

+11 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Montana State AGbd_3310fc3e52959a1b2022-02-18Candidate
Oregon State AGbd_66e850c7b658631f2022-02-18Verified
Massachusetts State AGbd_81fb850493c1f6d92022-02-18Verified
Indiana State AGbd_8d885d53f1427d3f2022-02-18Verified

Show 4 more filings ↓up to 109d gap

Maine State AGbd_a919a5f469090b542022-02-18Verified
Illinois State AGbd_94ac72ab0a95622d2022-01-01 · +48dVerified by operator
Maine State AGbd_40afb8ad7dca4af52022-06-07 · +109dVerified
Maine State AGbd_f1d21f60cb700f432022-06-07 · +109dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Welfare & Pension Administration Service
norm: welfare pension administration service
Domain: wpas-inc.com
Industry: Professional Servicesllm

Discovered: Jul 21, 2021
Breach occurred: Jul 15, 2021 – Jul 21, 2021
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 18, 2022
Affected individuals: 103,557state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the United States Department of Health of Human Services

During the incident: Activated its Incident Response Team
Isolated the affected systems
Initiated other containment measures
Engaged third-party forensic specialists to assist with the investigation
Notified the Federal Bureau of Investigation
Resetting passwords across the network
Providing access to credit monitoring services for twelve (12) months, through Kroll
Changes made: Reviewing and enhancing existing policies and procedures
Implementing additional safeguards to further secure the information in its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(212 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+48d

Oregon State AG+48d

Massachusetts State AG+48d

Indiana State AG+48d

Maine State AG+48d

Washington State AG+48d · this page

Maine State AG+157d

Pattern: first filing Jan 1 (IL), last Jun 7 (ME) — a 157-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA5343.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 18, 2022
Raw hash: 2b3113d3bcf934aec81276c63af484b1e41c4620a992ca7cbd5ec22f8a768a20

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityWelfare & Pension Administration Service

Incidentdiscovered Jul 21, 2021

Stated responseActivated its Incident Response Team

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com